Global Privacy Policy

Last Revised: February 10, 2026

Greystones Retail SL, a company incorporated and based in Madrid, Spain (“Inevista,” “us,” “we,” or “our”) operates the www.inevista.com website (the “Site”) and provides global mobility services and related offerings (the “Services”) available through the Site.

Inevista has developed a global privacy program to ensure the same high standards of privacy protection regardless of where you are located. This Privacy Policy explains how we collect, use, and disclose information about you. It forms part of our Inevista Platform Terms of Service. Unless otherwise defined herein, capitalised terms have the same meanings as in our Terms of Service.

1. Scope of Application

This Privacy Policy applies to:

Visitors of the Site with whom Inevista does not have a contractual relationship
Clients who use our Services, including client representatives
Suppliers who provide products or services to Inevista
Candidates applying for roles or engaging with us
Prospects and participants in webinars, conferences, trade events, and surveys

By using our Site and/or Services, or engaging with Inevista in any way, you agree to the collection and use of your information in accordance with this Privacy Policy.

2. Information We Collect

Inevista collects and stores certain information about you, which may be used on its own or in combination with other information to identify you (“Personal Information”). The categories of Personal Information we may collect include:

Contact information: physical addresses, email addresses, and phone numbers.
Identification information: full name, government ID, passport, date of birth, and selfie photographs.
Financial information: bank account details and payment card details.
Transactional information: details of transactions and payments to and from your accounts, including amounts and dates.
Contractual information: details about the products or services we provide to you.
Locational information: country, IP address, and locations where you have used your card.
Usage information: data about how you use our Services and Site, including metadata.
Technical information: IP address, login data, browser type and version, timezone, and operating system.
Communications: content and metadata from communications between us.
Professional information: current and past job positions, degrees, and qualifications.
Public and third-party records: publicly available information and data from third parties such as credit reference or fraud protection agencies.
Consents: any permissions, consents, or preferences you provide.
Community Platform Content: comments, files, messages, and other materials posted on our platform.
Biometric Data: where required for identity verification, we may collect a selfie photograph and government-issued identification and use facial recognition technology to verify your identity. This constitutes special category data under GDPR Article 9 and is only processed with your explicit consent.
Other information: any additional information you choose to provide through any available channel.

Anonymised data that cannot identify you does not constitute Personal Information for the purposes of this policy.

3. Sources of Your Personal Information

We collect Personal Information from the following sources:

Directly from you when you use our Services, complete contact forms, request marketing communications, participate in surveys, or contact us.
Automatically through our Site and Services, including security details, app or browser settings, marketing choices, and device data.
Through cookies and internet tracking technologies, as described in our Cookie Policy.
From third parties including business partners, service providers, advertising networks, analytics providers, fraud protection services, Payment Service Providers (PSPs), social networks, public information sources, market researchers, and government or law enforcement agencies.

4. How We Use Your Information

We use your Personal Information for the following purposes and on the following legal bases:

Managing our contractual relationship with you and providing our Services — Legal basis: Performance of contract; Legal obligation.
Improving our business, enhancing services, and developing new offerings — Legal basis: Performance of contract; Legitimate interest.
Providing secure access to our Services, including identity and verification processes — Legal basis: Performance of contract; Legitimate interest.
Marketing and event-related communications, including personalised content and advertising — Legal basis: Consent; Legitimate interest.
Assessing candidates for available positions — Legal basis: Performance of contract; Legitimate interest.
Protecting the security and integrity of our Site, Services, and business — Legal basis: Legitimate interest; Legal obligation.
Communicating about our Site and Services, including notifying changes and providing customer support — Legal basis: Performance of contract; Legitimate interest.
Managing business operations, payments, and debt collection — Legal basis: Performance of contract; Legitimate interest.
Meeting legal, regulatory, and tax reporting obligations — Legal basis: Legal obligation.
Providing and maintaining the Inevista Community Platform — Legal basis: Performance of contract; Legitimate interest.
Aggregating pseudonymised data for compensation benchmarking and academic research — Legal basis: Consent; Performance of contract.

Where processing is necessary for the performance of a contract or required by law, failure to provide your information may prevent us from delivering certain services.

5. Marketing Communications

We may contact you with newsletters and marketing information that may be of interest to you. You may opt out at any time by following the unsubscribe link in any email or by contacting us directly. Please note that even after opting out of marketing communications, we may continue to send you transactional or administrative messages related to the Service.

6. Sharing Your Information with Third Parties

We do not sell or trade your Personal Information. We may share your information only in the following circumstances:

With clients to whom you provide your services.
With trusted third-party agents, partners, suppliers, and service providers who assist us in delivering our Services, including website hosts, data hosts, cloud software providers, IT providers, identity verification providers, customer support providers, payment processors, financial institutions, legal advisors, auditors, and insurance companies. These parties are bound by confidentiality obligations and may only use your information as specified in their agreement with us.
With government agencies, law enforcement authorities, regulators, or other entities with legal authority, where required or permitted by law.
With a third party that acquires any part of our business through merger, consolidation, divestiture, or purchase of assets.
With academic institutions for research purposes, under confidentiality agreements ensuring only de-identified and aggregated data is published.
In anonymised, aggregated, de-identified form in public reports.
With current and future Inevista affiliates, in a manner consistent with this Privacy Policy.
With third-party advertising partners, such as social networks, for targeted advertising purposes, where you have provided consent or where we have a legitimate interest.
Where you have given your explicit consent.

7. Retention of Your Personal Information

We retain your Personal Information only for as long as necessary to fulfil the purposes for which it was collected, consistent with applicable law. Indicative retention periods are as follows:

Client and contractual data: retained for the duration of the contractual relationship and for up to 7 years thereafter to comply with legal and tax obligations.
Marketing data: retained until you withdraw consent or opt out.
Candidate data: retained for up to 2 years from the date of application, unless a longer period is required by law.
Biometric data: retained only for the duration necessary to complete identity verification and deleted immediately thereafter.
Website usage and technical data: retained for up to 2 years.

For retention periods specific to the Services provided to you, please refer to the Data Processing Addendum.

8. Security

The security of your Personal Information is important to us. We implement appropriate technical and organisational measures to protect your information against loss, misuse, unauthorised access, disclosure, alteration, and destruction. Access to your Personal Information is restricted to employees, agents, contractors, and third parties who have a legitimate business need to access it, and all such persons are bound by confidentiality obligations.

If you have selected a password or other login credentials to access the Inevista platform, you are responsible for maintaining their confidentiality and must not share them with any third party.

Please be aware that no method of transmission over the internet or electronic storage is 100% secure. If you become aware of any security or privacy breach, please contact us immediately at contact@inevista.com.

9. International Transfers

Your Personal Information may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your jurisdiction. Where we transfer personal data outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place in accordance with applicable data protection law, including:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Transfers to countries that have been granted an adequacy decision by the European Commission.
Other legally recognised transfer mechanisms as permitted under GDPR.

By using our Site and/or Services, you acknowledge that your data may be transferred and processed as described above.

10. Third-Party Advertising, Links, and Content

Our Site may contain links to third-party sites not operated by us. We allow third parties, including advertising networks, to collect information about your online activities through cookies and similar technologies for the purpose of displaying targeted advertisements. We have no control over, and accept no responsibility for, the content or privacy practices of any third-party site.

We participate in programmes such as Meta’s Custom Audience programme and similar offerings from LinkedIn, X (formerly Twitter), TikTok, and Google, to display relevant and personalised advertisements. We only process your information for this purpose with your consent or where we have a legitimate interest. You may object to the use of your Personal Information for direct marketing purposes at any time as set out in the “Your Rights” section below.

11. Cookies

We use cookies and similar tracking technologies on our Site in accordance with applicable law, including the Spanish Ley 34/2002, de Servicios de la Sociedad de la Información y de Comercio Electrónico (LSSI-CE). Please refer to our Cookie Policy for full details on the cookies we use, their purpose, and how you can manage your preferences.

12. Children’s Privacy

Our Site and Services are not directed at children under the age of 18. We do not knowingly collect Personal Information from minors. If you are a parent or guardian and believe your child has provided us with Personal Information, please contact us immediately. Upon becoming aware of such collection without verifiable parental consent, we will take steps to delete the information from our systems.

13. Your Rights

Under applicable data protection law, including the GDPR and the Spanish Ley Orgánica 3/2018 (LOPDGDD), you may have the following rights in respect of your Personal Information:

Right of access: to obtain a copy of your Personal Information and information about how it is processed.
Right to rectification: to correct inaccurate or incomplete Personal Information.
Right to erasure: to request deletion of your Personal Information in certain circumstances.
Right to restriction: to restrict the processing of your Personal Information.
Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
Right to data portability: to receive a portable copy of your Personal Information or have it transferred to a third party.
Right to withdraw consent: to withdraw consent at any time where processing is based on consent.
Right not to be subject to automated decision-making: to object to decisions based solely on automated processing or profiling.
Right to lodge a complaint: you have the right to lodge a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos — AEPD) at www.aepd.es, or with the supervisory authority in your country of residence.

To exercise any of these rights, please contact us at contact@inevista.com. We may ask you to verify your identity before processing your request. We will respond within the timeframes required by applicable law.

14. Data Protection Officer

Where required under applicable law, Inevista will appoint a Data Protection Officer (DPO). For any data protection queries or to exercise your rights, please contact us at: contact@inevista.com or by post at our registered address: Greystones Retail SL, Madrid, Spain.

15. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time. The “Last Revised” date at the top of this page reflects when the most recent changes were made. Your continued use of the Site and/or Services after any modifications constitutes your acknowledgment of and agreement to the updated Privacy Policy. We encourage you to review this page periodically.

16. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of Spain, including the GDPR as implemented in Spain, the LOPDGDD, and the LSSI-CE. Any disputes arising in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Spain, without prejudice to your rights as a consumer under applicable European Union law.

17. Contact Us

If you have questions or concerns regarding this Privacy Policy or the handling of your Personal Information, please contact us at:

Greystones Retail SL Madrid, Spain

Email: contact@inevista.com